Gala Games (GALA) (2024) — Crypto Hack
Partially MitigatedAn attacker exploited Gala Games' token minting contract to mint $200M worth of GALA tokens, though only ~$24M was successfully sold before the contract was paused.
Summary
An attacker exploited Gala Games' token minting contract to mint $200M worth of GALA tokens, though only ~$24M was successfully sold before the contract was paused.
How It Was Compromised — DeFi via Smart Contract Exploit / Unauthorized Mint
On May 20, 2024, an attacker exploited a vulnerability in Gala Games' GALA token contract that allowed unauthorized minting of new tokens. The attacker minted approximately $200M worth of GALA tokens, though the theoretical maximum damage was significantly higher. The attacker was able to sell only a portion of the minted tokens (~$24M) before Gala Games paused the contract and the token price collapsed. The pNetwork bridge, which had administrative control over the GALA contract, was used to freeze the remaining minted tokens. Gala Games later announced a $1M bounty for information leading to the attacker's identification.
Fund Flow & Laundering Analysis
The attacker sold a portion of the minted GALA tokens for ETH on decentralized exchanges, causing the GALA price to crash. The ETH proceeds were moved through multiple intermediary wallets. The remaining minted tokens were frozen by pNetwork. Gala Games offered a bounty and engaged law enforcement. The actual realized loss was significantly less than the theoretical $200M due to the contract pause and price collapse.